Description
we got reports for 2 injection attacks against the DeltaSpike windowhandler.js. This is only active if a developer selected the ClientSideWindowStrategy which is not the default.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Apache DeltaSpike | Apache DeltaSpike up to including 1.9.2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.deltaspike:deltaspike | < 1.9.4 | 1.9.4 | GHSA-rhg5-fqr3-hrf5 |